The Quiet Curriculum

Start with the workload. FIRST's June 15 forecast projected roughly 66,000 CVEs for 2026. By July 1, the first-half count had reached 35,364, one new CVE every 7.4 minutes. Last year closed at 48,185, up 20.6 percent from 39,962 in 2024. The volume grew fast enough that NIST changed how it handles the National Vulnerability Database in April. Its old aim was to enrich every entry. Its new model uses risk-based priorities. NIST said submissions had grown 263 percent in five years.

Anyone who works a queue knows what those numbers mean. What you knew on certification day begins losing value while the certificate is still warm. Each new entry can change a risk decision, a detection rule, a patch priority, or an answer you gave a client last month. The knowledge base moves during the workday.

The workforce research has caught up. For years, the headline was the number of open seats. In March, the SANS/GIAC workforce report asked organizations whether a "staffing shortage" or a "skills gap" was the bigger problem. Skills won 60 to 40. The margin had been 4 points one year earlier.

SANS sells training and certifications. Keep that commercial interest in view. The directional change still matters. Within twelve months, one of the field's flagship workforce studies shifted its focus to the capability of people already in the field.

That puts learning inside the job. The profession acknowledges this through continuing education, although the burden varies by credential. ISC2 requires 120 continuing-education credits over a three-year CISSP cycle and suggests 40 a year. ISACA also requires 120 over three years for CISA, with a hard floor of 20 each year. CompTIA requires 50 units per Security+ cycle. These systems record qualifying activity. A log cannot show how much of a webinar survived the week. A conference session or vendor course may change a decision or improve live-system performance; the credit record does not measure either result.

The formal requirement is therefore a compliance floor. The working requirement is larger and has no published ceiling. A field that reprices itself by the hour asks us to learn continuously, then leaves most of us to design the method. I think of that as the quiet curriculum: a permanent, self-directed degree program running beside the job. There is no syllabus, and nobody grades the whole program. Careers still reflect how well we attend it.

Most of us fill those hours with what the industry sells: video libraries, bootcamps, exam guides, and practice PDFs marked in several colors of highlighter. Paulo Freire would have recognized the arrangement. His 1963 literacy project in Angicos worked with about 300 rural participants. He was jailed after the following year's military coup. Freire called passive, deposit-based education the banking concept: "Education thus becomes an act of depositing, in which the students are the depositories and the teacher is the depositor."

The model is convenient. It gives vendors enrollment counts and gives learners something to log. A certificate still arrives on schedule. None of those records establishes what the learner can do on Monday morning. Freire spent his career developing an alternative grounded in action and reflection. Tuesday's edition belongs to that alternative.

Bloom's taxonomy gives us another useful check. Benjamin Bloom's taxonomy of educational objectives appeared in 1956 and was revised in 2001. It moves through remember, understand, apply, analyze, evaluate, and create. Certification exams often use multiple-choice questions. Well-written questions can reach higher-order judgment, so format alone cannot determine the level. Even so, remembered facts do not reproduce the work. At 3 a.m., an incident commander has to evaluate incomplete evidence and create a course of action under pressure. Port numbers help. Recall by itself leaves the decision undone. A learning habit earns its place when it helps move knowledge into use.

The series title acknowledges Stephen Covey. I use five habits here to describe how professionals can run the education the field quietly requires. They come from the cognitive-science literature of the last fifty years, read against the field's own data, and each gets a full edition this week. In brief, they are:

1. Retrieve, don't reread. Study by pulling knowledge out of your head, closed-book, before an incident does it for you. Practice testing is among the best-supported findings in the learning sciences.
2. Put it on a calendar, and mix it up. Spaced study has broad support, and mixing similar, confusable topics can beat finishing them one at a time, even though both methods feel worse while you do them. Monday's edition.
3. Practice on the real thing, then reflect. Action on real systems, joined to reflection on what the action meant. Labs, exercises, and the write-ups that turn them into learning. Tuesday's edition, with Freire.
4. Calibrate against instruments, not feelings. Self-assessment is especially unreliable where skill is lowest. Effective professionals replace "I feel ready" with tests, feedback, and external evidence. Wednesday's edition.
5. Learn in company, and teach to learn. Skill lives in communities of practice, and preparing to teach measurably deepens the teacher's own learning. Thursday's edition.

Habit one begins today because it changes a study session with one instruction: close the material and retrieve.

Retrieve, don't reread.

Henry Roediger and Jeffrey Karpicke demonstrated why in 2006 at Washington University. Students learned prose passages. Some restudied the text; others took free-recall tests and wrote down what they could remember with the text closed. At five minutes, the restudiers scored 81 percent and the tested group scored 75. A week later, the ordering reversed. The tested group retained 56 percent against the restudiers' 42.

A second experiment made the comparison sharper. Students who studied once and took three tests scored 61 percent after a week. Students who studied four times and took one test scored 40 percent. The repeated studiers had completed more than four times as many readings. Their method produced a smoother session and a weaker delayed result. Retrieval made the gaps visible while there was still time to repair them.

The confidence result belongs on every certification course syllabus. The repeated studiers were also the most confident that they would remember. The group using the weaker strategy rated it the winner.

Five years later, Karpicke and Janell Blunt compared retrieval practice with elaborative concept mapping in Science. On a one-week test, retrieval produced about a 50 percent advantage, including on questions that required inference. Eighty-four percent of participants did better after retrieval practice. Seventy-five percent expected concept mapping to work as well or better. The sensation of fluency deserves cross-examination, especially when the page looks familiar and the answer feels nearby. Wednesday's edition returns to that problem.

The case extends well beyond two experiments. In 2013, John Dunlosky and colleagues reviewed ten common study techniques against the accumulated evidence. Practice testing and distributed practice received the top rating. Rereading, highlighting, and summarization rated low. A 2021 Psychological Bulletin meta-analysis took the testing effect into classrooms. It aggregated 222 studies covering 48,478 students and found that the benefit held across subjects and levels.

For a practitioner, the translation is direct. Close the runbook and write the containment steps for ransomware on a domain controller from memory. Then reopen it and mark the gaps. Explain BGP route hijacking aloud before opening the RFC. Rebuild last quarter's detection logic on a whiteboard and compare it with the repository. Ask a colleague to question you as an auditor while your evidence folder stays closed.

Each exercise creates friction. That discomfort carries information about missing steps and explanations that collapse under pressure. Rereading can polish recognition without exposing those weaknesses.

Security teams already understand this method when the object under test is a system. They restore backups and pull failovers before trusting them. Control confidence comes through testing. Habit one applies the same standard to the practitioner.

The week will keep that practical test in view. The calendar comes next. Later editions cover labs with reflection, calibration against evidence, learning in company, and what the five habits add up to. Each edition is for people with scarce learning time and jobs that change every 7.4 minutes.

And if this series earns a place in your week, the newsletter arrives weekly: subscribe at https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7464687787661926400

Sources (read with the noted provenance caveats)

Jerry Gamblin, "CVE Mid-Year 2026 Check-In," July 1, 2026 (35,364 CVEs in H1 2026, one every 7.4 minutes), and "2025 CVE Data Review," January 1, 2026 (48,185 in 2025, +20.6 percent; 39,962 in 2024). Analyses of the official CVE List.

FIRST, mid-year vulnerability forecast, June 15, 2026: roughly 66,000 CVEs projected for 2026.

NIST, "NIST Updates NVD Operations to Address Record CVE Growth," April 15, 2026: 263 percent submission growth 2020 to 2025; move to risk-based enrichment.

SANS Institute/GIAC, 2026 Cybersecurity Workforce Research Report, March 11, 2026: 60 percent name skills gaps over staffing shortages (40 percent), versus a 4-point margin the prior year; 947 respondents. SANS sells training.

CPE requirements verified at the certifying bodies, July 2026: ISC2 (120 CPE credits per three-year cycle, 40 per year suggested), ISACA (120 per three years, minimum 20 annually), CompTIA (50 CEUs per three-year cycle for Security+).

Paulo Freire, Pedagogy of the Oppressed, trans. Myra Bergman Ramos, 30th Anniversary Edition (Continuum, 2000), banking-concept quotation from Chapter 2 (p. 72). Biographical details (Angicos, 1963; jailed after the 1964 coup) per Instituto Paulo Freire and Encyclopaedia Britannica.

Benjamin S. Bloom (ed.), Taxonomy of Educational Objectives, Handbook I: Cognitive Domain (McKay, 1956); Lorin W. Anderson and David R. Krathwohl (eds.), A Taxonomy for Learning, Teaching, and Assessing (Longman, 2001).

Stephen R. Covey, The 7 Habits of Highly Effective People (Free Press, 1989), title acknowledged.

Henry L. Roediger III and Jeffrey D. Karpicke, "Test-Enhanced Learning," Psychological Science 17(3), 2006: 56 versus 42 percent at one week; repeated testing 61 percent versus repeated study 40 percent; repeated studiers most confident.

Jeffrey D. Karpicke and Janell R. Blunt, "Retrieval Practice Produces More Learning than Elaborative Studying with Concept Mapping," Science 331, 2011: roughly 50 percent advantage; 84 percent of participants benefited; 75 percent expected concept mapping to work as well or better. A methods comment by Mintzes and colleagues and the authors' reply appear in Science 334.

John Dunlosky, Katherine A. Rawson, Elizabeth J. Marsh, Mitchell J. Nathan, and Daniel T. Willingham, "Improving Students' Learning With Effective Learning Techniques," Psychological Science in the Public Interest 14(1), 2013: practice testing and distributed practice rated high utility; rereading, highlighting, and summarization rated low.

Chunliang Yang, Liang Luo, Miguel A. Vadillo, Rongjun Yu, and David R. Shanks, "Testing (Quizzing) Boosts Classroom Learning," Psychological Bulletin 147(4), 2021: g = 0.499 across 222 studies and 48,478 students.